Sideview Utils 2.1 Redirector not working

[responsys_cm]

I have a search that lists a bunch of files over the last 24 hours. I want users to be able to click on a row in the table and have it open a new web page with the appropriate URL value. But when users click on the row, it only opens up a web page with the first URL value in the table.

<module name="Search" layoutPanel="panel_row3_col1" autoRun="True">
    <param name="latest">now</param>
    <param name="earliest">-24h@h</param>
    <param name="search"><![CDATA[
      signature_type="Discovery" signature="First execution on network" | eval   installer=if(isnull(installer),"Unknown",installer) | eval url="http://www.file.net/process  /"+file+".html" | table file,path,process,installer,dest_nt_host,url
    ]]></param>

    <module name="HTML">
      <param name="html"><![CDATA[
        <h3>First Executions - 24 Hours</h3>
        ]]></param>
    </module>

    <module name="Pager">

      <module name="SimpleResultsTable">
        <param name="entityName">results</param>
        <param name="drilldown">row</param>

        <module name="ResultsValueSetter">
          <param name="fields">url</param>

          <module name="Redirector">
            <param name="popup">True</param>
            <param name="url">$url$</param>
          </module>
        </module>
      </module>
      <module name="Pager" />
    </module>
  </module>
</module>

[sideview · Accepted solution]

You've just got one too many moving parts in here.

ResultsValueSetter does exactly that -- it goes and gets the given field value(s) from the first row of the current search results.

If you instead want to get a value from the row the user clicked on, then anywhere downstream from SimpleResultsTable or FlashChart or JSChart, then you use $click.fields.fieldName$, in this case $click.fields.url$. Note: If you're using hte older 1.3.X version on Splunkbase you'll only have these keys on the SimpleResultsTable module. In 2.0.X and 2.1.X you'll have the keys also downstream from the charting modules.

For example:

<module name="SimpleResultsTable">
  <param name="entityName">results</param>
  <param name="drilldown">row</param>

  <module name="Redirector">
    <param name="url">$click.fields.url$</param>
    <param name="popup">True</param>
  </module>

</module>

---

Update

and if you want the Redirector to pass a timerange, you'd add the following params to it.

<param name="earliest">$search.timeRange.earliest$</param>
<param name="latest">$search.timeRange.latest$</param>

the arg.* params all map one-to-one to the actual querystring arguments so it's pretty straightforward to construct a redirect to a anywhere, whether its a custom advanced XML view, or whether its a third party web application.

[sideview]

(this was along time ago now, but indeed the "Table" module was launched in Sideview Utils way back in 2.0, so yes you can now do this, using the Table module's "hiddenFields" param. http://sideviewapps.com/apps/sideview-utils

[sideview]

Right now, not without using some custom JS code to muck with the SimpleResultsTable yourself. That said, I'm in the process of making a Table module to replace SimpleResultsTable for Sideview users and indeed it has this feature already.

Right now the implementation is that it has an optional "fields" param to narrow down the visible columns. Andalso an optional "hiddenFields" param, to say what other fields should be available to downstream drilldown logic, but not actually displayed in the table.

Follow me on twitter and I'll definitely announce the launch there. ( @sideview_apps )

[responsys_cm]

Thanks, Nick.

Is there any way to use a field in the redirector that isn't displayed in the table?

C